hellman

"""
echo pass | TRACE=trace1 time gdb -x script.py -batch ./unconventional >/dev/null
~1 minute
"""
import gdb, re, os

gdb.execute('break *0x40542f')
gdb.execute('run')

f = open(os.environ["TRACE"], "w")

hellman

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <stdint.h>
#include <unistd.h>
#include <assert.h>
#include <openssl/aes.h>

/*
gcc -O3 solve.c -L. -lghash_clmul -lcrypto -o solve

hellman

#-*- coding:utf-8 -*-

# python3 adaptation...
from __future__ import print_function, division

from sage.all import *

# begin copy paste ================
import hashlib
f = open('gov_officials_PK.txt','r')

hellman

#-*- coding:utf-8 -*-

from sage.all import *

BITS = 2048
NLEAK = 1024-22
# E = 0x10001
E = next_prime(2**22)
print "E", E

hellman

hellman

#-*- coding:utf-8 -*-

from common import *


def extend(alg, prefhashes):
    if alg == 0:
        prefhash = prefhashes[alg]
        table = {}
        seen = set()

hellman

In this challenge the flag is treated as a polynomial over GF(257), it is blinded by a random known polynomial, and then it is evaluated at 107 first integers. However, each result is corrupted with probability 43/108. The polynomial has degree 25, so we need 26 correct points to interpolate it. Observe that by choosing random 26 points from those given, we have a feasible probability of having an error-less set:

sage: math.log(binomial(108-43, 26) / binomial(108, 26), 2)
-22.716429556377932

That is, we need to try around 7 000 000 random subsets. This can be done in 10 minutes on 8 cores by a simple Sage code.

hellman

#!/usr/bin/env sage
'''
Multivariate Public Key Cryptosystems by Jintai Ding et al., Chapter 2
Explains attack by Jacques Patarin.

The idea is to find a relation of plaintext-ciphertext bytes such that
when ciphertext is fixed, the relation is linear in plaintext.
Patarin showed that a sufficient amount of such relations exists.
'''
from sage.all import *

hellman

#!/usr/bin/env sage
'''
The third LFSR has low period: 378.
If the value in positions 0,378,2*378,... is equal to 0,
then the combine functions become AND of the first two LFSRs.
If the value in positions 0,378,2*378,... is equal to 1,
then the combine functions become OR  of the first two LFSRs.
We can distinguish both cases easily by number of 0s/1s
(should be 25% in the first case and 75% in the second case)

hellman

"""
Slide attack on the TwinPeaks2 cipher from NSUCRYPTO.

Disclaimer: this is not an optimal solution, just a proof-of-concept!

An actual solution is to note that Reverse(Encrypt(Reverse(x)) = Decrypt(x), where Reverse(a,b,c,d) = (d,c,b,a).
"""

from random import shuffle, randint